Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects periodic outbound HTTP POST requests consistent with C2 beaconing behavior associated with the Latrodectus malware. The rule identifies multiple POST requests occurring within a 10-minute window, a pattern often used by Latrodectus for command-and-control heartbeats.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Detects repeated authentication login attempts (opcode 0xA0) against Dahua Easy4IP devices over TCP port 37777, indicative of a brute-force or credential stuffing attack.
Detects Remote Desktop Protocol (RDP) traffic occurring over non-standard high ports (64350, 64330, 65535, 65111, 61256), which is indicative of SilkParasite C2 activity or potentially malicious lateral movement attempting to bypass standard port monitoring.
Detects network traffic involving TLS certificates that impersonate the Uzbekistan state railway authority, specifically using certificates issued by 'TLC DV TLS CA' or specific known malicious certificate fingerprints. This activity is attributed to the threat actor SilkParasite.
Detects network traffic associated with exploitation attempts against Dahua P2P relay services. The rules monitor for specific URI patterns ('/online/p2psrv/' and '/probe/device/') used to probe the device, as well as traffic containing a hardcoded AES-OFB initialization vector, which indicates attempts to exploit CVE-2025-31702.
Detects network activity associated with the SilkParasite actor's NodeEdgeRAT malware, including DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to the identified command-and-control infrastructure 'hoster-kg.com'.
Detects a sequence of events where a host connects to 'speedtest.net' followed by a burst of outbound SYN packets to TCP port 37777. This pattern may indicate an adversary using legitimate web traffic to calibrate their scanning rate or bypass network controls before performing a targeted scan.
This rule detects an attempted authentication bypass vulnerability (CVE-2021-33045) targeting Dahua NetKeyboard devices. The exploit involves a specific HTTP request structure to the 'global.login' endpoint, where the 'loginType' parameter is set to 'Loopback' and the 'ipAddr' is set to '127.0.0.1', attempting to leverage internal loopback logic to circumvent authentication mechanisms.
Detects network packets targeting the Dahua SDK service (port 37777) that match the signature of a crafted login request, specifically checking for the 0xFF/0x00 magic header and the 0x00/0xA0 opcode. This pattern is commonly associated with unauthorized authentication attempts, including brute-force attacks or exploitation of known authentication bypass vulnerabilities in Dahua devices.
Detects network traffic and DNS queries associated with the SilkParasite command-and-control (C2) infrastructure. This rule monitors for established RDP-over-TLS connections using non-standard, high-numbered ports and identifies associated DNS lookups for known C2 hostnames.
Detects network traffic to GitHub API endpoints that matches patterns indicative of RUSTYSHADE malware communicating with a private repository for command and control. The rule specifically looks for access to repository content paths related to commands, results, heartbeats, screenshots, or information files, coupled with the inclusion of an Authorization token in the HTTP header.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
This rule detects network traffic patterns associated with the Sauron Loader malware family. It specifically identifies outbound HTTPS beaconing to known malicious C2 domains using the TLS SNI (Server Name Indication) field.
Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.
Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.
Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.
Detects the handshake process of the frpc (Fast Reverse Proxy Client), which is associated with the RatHat malware family, attempting to register a reverse tunnel for command and control purposes.
Detects HTTP POST requests directed to the URI path '/api/credentials' over the non-standard TCP port 8133, which is indicative of AMOS (Atomic macOS) Stealer exfiltrating stolen credentials to a C2 server.
Page 38 of 110